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Abstract 

We show that the capacity region of the broadcast chan- 
nel with confidential messages does not change when the 
strong security criterion is adopted instead of the weak 
security criterion traditionally used. We also show a con- 
struction method of coding for the broadcast channel with 
confidential messages by using an arbitrary given coding 
for the broadcast channel with degraded message sets. 

1 Introduction 

The information theoretic security attracts much attention 
recently [19|, because it offers security that does not de- 
pend on a conjectured difficulty of some computational 
problem. A classical problem in the information theoretic 
security is the broadcast channel with confidential mes- 
sages (hereafter abbreviated as BCC) first considered by 
Csiszar and Korner ifTD . in which there is a single sender 
called Alice and two receivers called Bob and Eve. The 
problem in IfTTI is a generalization of the wiretap chan- 
nel considered by Wyner ll24l . In the formulation in IfTTI . 
Alice has a common messages destined for both Bob and 
Eve and a private message destined solely for Bob. The 
word "confidential" means that Alice wants to prevent 
Eve from knowing much about the private message. The 
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coding in this situation has two goals, namely error cor- 
rection and secrecy. 

The traditional criterion of judging the secrecy is the 
so-called weak security criterion, which requires that the 
mutual information divided by the code length between 
the secret message and the adversary's information con- 
verges to zero as the code length goes to the infinity. 
Suppose that the secret message S„ and the adversary's 
message Z" of length n have the identical part of length 
n/logn and that the rests are statistically independent, 
then the weak security criterion judges this situation as 
secure, while the adversary knows infinitely much infor- 
mation on the secret message. This example suggests that 
the weak security criterion is inappropriate for some ap- 
plications. 

To exclude such an insecure situation, Maurer fl2Tl in- 
troduced the strong security criterion, which requires the 
mutual information converges to zero without division by 
the code length. It is important to study the capacities 
and the capacity regions of various information theoreti- 
cal problems under the strong security criterion. The key 
agreement problem lfT0l [T6 22 1 and the wiretap channels 
0[lOl[T4][T6) have been studied under the strong security 
criterion. However, the capacity region for the BCC has 
not been clarified as far as the authors' knowledge, be- 
cause the strong security results in [3] [TO] [14] [161 for the 
wiretap channels do not seem to easily generalize to the 
BCCs. Note that [22 J cannot be used to prove the strong 
security of transmission of secret messages, and that [3] 
is an adaptation of ll22ll to the wiretap channels. We shall 
clarify that the capacity region under the strong security 
criterion is the same as that under the weak one. Our proof 
argument just attaches inverses of hash functions to an 
existing random coding argument for the broadcast chan- 
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nel with degraded message sets (hereafter abbreviated as 
BCD). Thus the analysis of decoding error probability in 
our proof automatically becomes as good as the best anal- 
ysis for BCD. The idea of attaching inverses of hash func- 
tions seems first appeared in Csiszar [10] in the context of 
information theoretic security. 

On the other hand, in a communication system with 
single sender and single receiver, the source coding and 
the channel coding are the most classical and fundamen- 
tal problems. The famous source-channel separation the- 
orem |9 Section 7.13] states that we can get an opti- 
mal source-channel joint coding by combining an opti- 
mal source coding and an optimal channel coding, at least 
in the sense of asymptotic information rate. Therefore, 
it is natural to ask if there is a similar separation theo- 
rem between secrecy coding and error correction coding 
in the information theoretic security. In this direction, re- 
cently Csiszar and Narayan |[T2l Lemma B.2] and Renner 
||23l Lemma 6.4.1] implicitly proved the separation theo- 
rem between secrecy coding and error correction coding 
in the key agreement problem considered by Maurer |20ll 
and Ahlswede-Csiszar [1|, which is also a classical and 
fundamental problem in the information theoretic secu- 
rity. Specifically, Csiszar, Narayan, and Renner showed 
that the optimal key rate can be attained for the model 
SW in [1 j with one-way public communication provided 
that we are given optimal probability distributions of the 
auxiliary random variables in the key capacity formula, 
by combining Slepian-Wolf encoder and decoder for er- 
ror correction and a family of two-universal hash func- 
tions (fully random functions in Ifl2ll ) for secrecy. How- 
ever, the separation in other problems does not seem to be 
explored, as far as the authors know. 

Although our argument for the capacity region of BCC 
in Section [3] separates the analysis of the decoding error 
probability and the mutual information, it does not sep- 
arate the construction of a code for error correction and 
provision of secrecy. In Section [4] we introduce another 
form of the privacy amplification theorem so that we can 
separate the code constructions for error correction and 
secrecy, then we clarify which rate pairs can be achieved 
by our separated code construction. 

This paper is organized as follows: Section [2] reviews 
relevant research results used in this paper. Section [3] 
proves the capacity region under the strong security crite- 
rion is the same as under the weak one. Section|4]presents 



a computational procedure of an upper bound on the mu- 
tual information when inverses of hash functions are at- 
tached to an arbitrary given code for BCD. Section[5]con- 
cludes the paper. 

2 Preliminaries 

2.1 Broadcast channels with confidential 

messages 

Let Alice, Bob, and Eve be as defined in SectionQ] X de- 
notes the channel input alphabet and J/ (resp. Z.) denotes 
the channel output alphabet to Bob (resp. Eve). We as- 
sume that X, if, and X are finite unless otherwise stated. 
We shall discuss the continuous channel briefly in Re- 
marks Q~2] and [14] We denote the conditional probability 
of the channel to Bob (resp. Eve) by Py\x (resp. Pz\x)- The 
set S„ denotes that of the private message and &„ does that 
of the common message when the block coding of length 
n is used. We shall define the achievability of a rate triple 
(Ru R e , Rq), where Ri is the rate of the secret message, 
R e is the so-called equivocation rate ifTTIl . and Ro is the 
rate of the common message. For the notational conve- 
nience, we fix the base of logarithm, including one used 
in entropy and mutual information, to the base of natural 
logarithm. Privacy amplification theorems reviewed later 
are sensitive to choice of the base of logarithm. 

Definition 1 The rate triple (R\, R e , Rq) is said to be 
achievable if there exists a sequence of Alice's stochas- 
tic encoder f„ from S„ X £„ to X", Bob's deterministic 
decoder ip„ : J/" — > S„ X &„ and Eve 's deterministic de- 
coder if/ n : Z" — * &n such that 

limPr[(S„,E n )*<p n (Y")orE„*i{,„(Z")] = 0, 

n— >oo 

. e H(S n \Z") 
hminr > R e , 

n — >oo jj 

. log|5„| 
hminf > Ri, 

n— >oo fi 

. log|«5„| 
hminf > Rq, 

n—><x> n 

where S „ and E n represent the secret and the common 
message, respectively, have the uniform distribution on 
S„ and £„, respectively, and Y" and Z™ are the received 
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signal by Bob and Eve, respectively, with the transmitted 
signal f„(S„,E„) and the channel transition probabilities 
Py\x, Pz\x- The capacity region of the BCC is the closure 
of the achievable rate triples. 

Theorem 2 [11] The capacity region for the BCC is 

given by the set of Rq, R\ and R e such that there exists 
a Markov chain U — > V — * X — > YZ and 

Ri + R < I(V; Y\U) + min[/(t/; Y), I(U; Z)], 
R < min[I(U;Y),I(U;Z)], 
R e < I(V;Y\U)- I(V;Z\U), 
R e < Ri. 

As described in Ifl9ll , U can be regarded as the com- 
mon message, V the combination of the common and the 
private messages, and X the transmitted signal. 

If we set R e = R\ then we have lim„^oo I(S„;Z")/n = 0, 
which is traditionally called perfect security, because Eve 
knows little about S„. However, Maurer [21 ] and Csiszar 
[ 1 1 observed that lim^oo I(S„;Z n ) = is a better cri- 
terion for the secrecy of S„ from Eve, and this stronger 
requirement is called the strong security criterion, while 
the traditional one is called the weak security criterion re- 
cently. 

Corollary 3 M1V The notation is same as Theorem\2\ If 
we require R e — R\, the capacity region for (Rq, Ri) is 
given by the set of Rq and R\ such that there exists a 
Markov chain U — > V — > X — » YZ and 

Rq < mm[I(U;Y),I(U;Z)], 
Ri < I(V;Y\U)- I(V;Z\U). 

2.2 Broadcast channels with degraded mes- 
sage sets 

If we set R e — in the BCC, the secrecy requirement is 
removed from BCC, and the coding problem is equiva- 
lent to the broadcast channel with degraded message sets 
(abbreviated as BCD) considered by Korner and Marton 

ma. 

Corollary 4 The capacity region of the BCD is given by 
the set ofRo and R\ such that there exists a Markov chain 
U ->V = X^YZand 

R < mm[I(U;Y),I(U;Z)], 



R + R\ < I(V; Y\U) + min[/(f/; Y), /(£/; Z)]. 

Throughout this paper, the information rate of the private 
message to Bob without secrecy requirement is denoted 
by R' { instead of R\, to emphasize the difference. One 
of several typical proofs for the direct part of BCD is as 
follows [5|: Given Pjjy, Rq, R[, we randomly choose 
exp(n7?o) codewords of length n according to P n v , and 
for each created codeword u", randomly choose exp(«/?'j) 
codewords of length n according to Py^i^u"). Over the 
constructed ensemble of codebooks, we calculate the av- 
erage decoding probability by the joint typical decoding, 
or the maximum likelihood decoding, etc. 

2.3 Privacy amplification theorem 

We shall use a family of two-universal hash functions HI 
and a privacy amplification theorem obtained by Hayashi 
1 16 1 based on the work by Bennett et al. [4]. So we shall 
review them. 

Definition 5 Let T be a set of functions from S\ to S2, 
and F the not necessarily uniform random variable on T. 
If for any x\ + xi 6 S\ we have 

Pr[F(x!) = F(x 2 )] < -i-, 

then T is said to be a family of two-universal hash func- 
tions. 

Proposition 6 Let L be a random variable with a finite 
alphabet X and Z any random variable. Let ¥ be a family 
of two-universal hash functions from £, to M, and F be 
a random variable on T statistically independent of L. 
Then 

I{F(L);Z\F) < ~\MmPi\z(L\Zy] (1) 
P 

for < p < 1. If Z is not discrete RV, I(F(L);Z\F) is 
defined to be H(F(L)\F) - E Z H(F(L)\F, Z = z). 

In addition to the above assumptions, when L is uni- 
formly distributed, we have 

1 \M\ p E[P uz (L\ZyP L (L)-P] 
~\MmP L \z(L\Zf] = m . (2) 

P \-L\ p P 

In addition to all of the above assumptions, when Z is a 
discrete random variable, we have 

\M\PE[P Llz (L\ZyP L (L)-P] 
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J] 2 ^W^z|L(zW 1+ ^z(z)- p . (3) 



Remark 7 /? was assumed that Z was discrete in A 16V . 
However, when the alphabet of L is finite, there is no dif- 
ficulty to extend the original result. 

As in lfl6l we introduce the following two functions. 
Definition 8 

<HP, Pz\l, Pl) = log J] J] PL(f)Pz\dz\0 1+p Pz(zT p (4) 



<P(P,Pz\l,Pl) = log^ Yj PL{e){Pz \ Lmm ~ P)) 

z W 



1-p 

(5) 



Observe that is essentially Gallager's function Eq |[T3l . 

Proposition 9 ^7?1 [7751/ exp(0(p, P Z \l, Pl)) is concave 
with respect to Pi with fixed < p < 1 and Pz\l- For 
fixed < p < I, Pl and Pz\l we have 

exp(^(p, P AL , P L )) < exp(0(p, P Z | L , P L ))- (6) 



3 Calculation of the average mutual 
information with random coding 

In this section we shall prove that the capacity region 
given in Corollary [3] is also the capacity region of the 
BCC under the strong security criterion. We do not need 
the proof for the converse part. We shall prove the direct 
part. Let the RV B„ on !B„ denote the private message to 
Bob without secrecy requirement, E„ on &„ the common 
message to both Bob and Eve, F„ on T„ a function in a 
family T n of two-universal hash functions from &„ to S„, 
A an RV indicating selection of codebook in the random 
ensemble constructed in the way reviewed in Section l272l 
U" = A(E n ) on tf and V" = A(B„, E n ) on V codewords 
for the BCD taking the random selection A taking into ac- 
count, and Z" Eve's received signal, where n denotes the 
code length. We assume that for every f„ e T„ is surjec- 
tive and for all s e S n the set {b e S„ | f n (b) = s] has the 
constant number of elements. Such requirement on f„ is 
satisfied, for example, when T n is the set of all surjective 
linear maps from &„ to S„ . 



The structure of the transmitter and the receiver is as 
follows: Fix a hash function /„ e T„ and Alice and Bob 
agree on the choice of /„. Given a secret message s n , 
choose b„ uniformly randomly from {b e S n \ f„(b) = s n }, 
treat b n as the private message to Bob, encode b„ along 
with the common message e n by an encoder for the BCD, 
and get a codeword v". Apply the artificial noise to V 
according to the conditional probability distribution P" x ^ v 
and get the transmitted signal x". Bob decodes the re- 
ceived signal and get b„, then apply f„ to b„ to get s„. This 
construction requires Alice and Bob to agree on the choice 
of /„. We shall show that I(S n ;Z n \F n ) = E f J(S n ;Z"\F„ = 
f n ) to be arbitrary small. This ensures that most choice 
of /„ makes I(S„;Z"\F„ = /„) small. The same argument 
was also used in [10|. 

Let S„ denote the RV of the secret message. Define 
B' n to be the RV uniformly chosen from the random set 
{b € &„ | F„(b) = S„). We want to apply the privacy 
amplification theorem to I(F n (B' n ); Z"\F n ). To use the the- 
orem (Proposition^ we must ensure independence of F„ 
and B' n . The independence is satisfied by the assumptions 
on T n if S„ is uniformly distributed. In that case B' n is uni- 
formly distributed over £„. Denote B' n by B„. The remain- 
ing task is to find an upper bound on I{F„(B„); Z"\F„, A). 
Since the decoding error probability of the above scheme 
is not greater than that of the code for BCD, we do not 
have to analyze the decoding error probability. 

Firstly, we consider I(F„{B n ); Z"\F„, A) with fixed se- 
lection A of A. In the following analysis, we do not make 
any assumption on the probability distribution of E n ex- 
cept that S„, E n , F„ and A are statistically independent. 



I(F n (B„);Z"\F„,A = A) 
< I(F n (B n );Z",E n \F n< A = A) 

= I(F„(B„); E„\F„, A - A) +I(F„(B„); Z"\F„, E„, A - A) 



=o 



= J] P En (e)I(F„(B„); Z n \F„, E„ = e, A = A) 



(7) 



< y ^expO^Q y 



pexp(npR[) — 

Pz^B,,,E,,,K=A{z\b,e) l+ Pp z ,, ]Eii=eA=A {z)- p (byEqs. 



1 The statistical independence of the corresponding random variables 
in f3][T0i) was not discussed in detail. 
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exp(npR\) 



pexp(np(R\)) 



v,z b:A.(b,e)=v 



-Pv n \E n =e,A=i(y) 



Pz»\B„,E,,A=Mb, e) l+ P Pz-\E„=e,A=A(zr P 



e 

Pz u \v"a=a( 



exp(npR\) 



777 ^ Pv"\E„=e,A=A(y) 



pexp(np(R[)) £J 

Pzi-\V^A=A(z\v) 1+P P Z . lE , l=e , A=A (zr P 

eXpilipRi + lf/(p,Pz"\V",A=A,Pv»\E„=e,A=A)) 



e 



pexp(np(R\)) 
exp(npRi + iff(p,Pz"\v,Pv\E n =e,A=d) 



(byEq. ©) 

+(p[p, P z -\v, ^ Pa\v*=u(X)Pv»\u»= u ,a=a)] 

A 

(concavity of exp(<p) is used) 
= - J] Pu^explnpiRi-R'^ 

P well" 

+(/>(p,Pz-\v,Pv\u-=w)] 

1 



(9) 



, 2 YlPuiudsxplpiRi-R'^ 

" u« ell" i=\ 

pexp(np(/?;)) ^ „ 

eX P (»p(^ 1 + ^(p, P Z»|V , P V"\E„=e,A=A)) = ~ fl Z Pu(Ui) eX PW*I ~ R 'l > 



" i=l «,et/ 



(8) 



We shall average the above upper bound over A. 
J] P En (e)I(F n (B n ); Z"\F„, A, E n = e) 

/I e 
exp(«p(/?! -#',) + ^(p, P Z »|V", Pv»\E„=e,A=A)) 



+(/)(p, Pz\V, Pv\U=u,)] 

= ^[expipiRi - R[)) 

J] exp(0(p, P Z |v, Pv|D=»))]". (10) 



ue-W 



We shall consider under what condition the upper 
bound goes to zero. Taking the logarithm of the upper 
bound ( [Tol l we have 



p 




A e 




exp(np(Ri - R\) + iff(p, Pz"\V",Pv><\u> 


=A(e),A=A)) 


P 

= Yj Pa(A) Tj Pu ^= a(u) 

A u 




exp(np(Ri - R\) + t//(p, P Z "\v",Pv«\U" 


=u,A=a)) 


P 

= Yi Po "MTi PAio " = "W 

u A 




exp(np(Ri - R[) + \]/{p, Pz»\v°,Pv»\u- 


= K,A=i)) 


P 

< J]Pu-{u)J]Pa\U"=u(X) 

u A 




exp(np(Ri -R' 1 ) + (pip, P z *\v»,Pv»\u» 


=ii,A=a)) 



log p + np 



Ri -R'i + 



- lo g(X Pu< - U ^ SX PWP' p z\v> p v\u=u))) 



ueU 



(*) 

We can see that (*) — > I(V;Z\U) as p — > 0. by applying 
the l'Hopital's rule to (*). 

This shows that the amount R' { - Rj of random 
garbage required to make S„ = F„{B„) secret from 
Eve is I(V;Z\U) per channel use. By choosing Rq = 
mm{I(U;Y), I(U;Z)} - 6 and R\ = I(V; Y\U) -S, we have 
completed the direct part proof. ■ 

Remark 10 Our proof does not require the common mes- 
sage E„ to be decoded by Bob. Our technique can provide 
an upper bound on the mutual information ofS n — F n (B n ) 
even when E„ is a private message to Eve. 
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Remark 11 The (negative) exponential decreasing rate 
of the mutual information in our argument is 



Ri -R\ + -log(2 p u(u) zxv(<f>(p,Pz\v,Pv\u=u)j) 



Minimizing the above expression over < p < 1, R\ and 
U -> V ^X^YZ such thatR < min{/(f/; Y), I(U; Z)\, 
and Z?j < I(V; Y\U) gives the smallest negative exponent. 
From the form of the mathematical expression, increase 
in /?j decreases the mutual information and increases the 
decoding error probability of the secret message to Bob. 
This suggests that the optimal mutual information and the 
optimal decoding error probability cannot be realized si- 
multaneously. 

Remark 12 We can easily carry over our proof to the 
case of the channel being Gaussian, because 

• we can extend Eq. (O to the Gaussian case just by 
replacing the probability mass functions Pz\l and Pz 
by their probability density functions. 

• the random codebook A obeys the multidimensional 
Gaussian distribution, 

• the concavity of (p is retained when its second argu- 
ment is conditional probability density, 

• and the all mathematical manipulations in this sec- 
tion remains valid when U, V, Z, A are continu- 
ous and their probability mass functions are replaced 
with probability density functions, while B„, E n , F n 
remain to be discrete RVs on finite alphabets. 



4 Separated code construction for 
the broadcast channel with confi- 
dential messages 

Suppose that we are given single triple of an encoder 
and decoders for BCD. We want to construct a code for 
BCC based on the code for BCD, by attaching the in- 
verse of a randomly chosen two-universal hash function 
to the given BCD code. If we could do this without loss of 
any optimality, then the practical study of codes for BCC 



would become unnecessary, because the study of practi- 
cal BCC codes can be reduced to that of practical BCD 
codes. We stress that the random choice of encoder and 
decoder is widely accepted as a practical method, see e.g., 

Let X be the uniform distribution on the given code- 
book, and Z Eve's received signal given X as channel in- 
put. By simply applying Proposition|6]to X and Z, the size 
of secret message set S has to satisfy 



mm 

0<p<l 



\SmPx\z(X\Zf] 



< acceptable value. (11) 



When the number of codewords is, say 2 1000 , evaluation 
of the left hand side is practically impossible. 

We shall introduce another form of the privacy amplifi- 
cation theorem alternative to Proposition|6]whose compu- 
tation as Eq. ( fTTT i is intractable with arbitrary given single 
BCD encoder, so that we can compute a suitable size of 
S. What follows is an extension of a result on the wiretap 
channel 1171 . The following theorem is an adaptation of 
the channel resolvability lemma |[T4l Lemma 2] . 

Theorem 13 Assume that the given family of two- 
universal hash function F from £,toM satisfies that 



\F 



(m)l = \M\' 



Vm, 



the statistically independent random variable K and L 
obey the uniform distributions on 'K and £,, respectively, 
and a fixed conditional probability Qz\k,l is given. We 
also assume that F is statistically independent of K and 
L. Then, 



I(F(L);Z\F)< 

for < p < 1. 
Proof. 

I(F(L);Z\F) 
< I(F(L);K,Z\F) 
= I(F(L);Z\K,F) 
\Mf 
\£\ p P 



|Mr°exp(0(p,6z|g,L,Pg,L)) 

(I7ci x ixiyp 



exp((/r(p, P Z \K=k,L, Ph)) 



6 



(byEqs. GKD) 

^(*)T7E- exp(0(p, P Z \K=k,L, Pl)) (by Eq. ©) 



* =|9C|-" z 

£ PK(k)P L ({)(Pz\K,L(z\k, O llil - p) ) 



1-p 



VK x 
\K x 



z V *,f 



exp(0(p, P Z | X) L, 



Suppose that we are given a triple of an encoder and 
decoders for the BCD. We shall derive a computable up- 
per bound on the mutual information between the secret 
message and Eve's received signal. Let S n be the secret 
message to Bob, E„ be the common message to both Bob 
and Eve. We assume that S„ and E„ are uniformly dis- 
tributed and that they are statistically independent to each 
other. Let F„ be an RV on a family T n of two-universal 
hash functions. F„ is statistically independent of (S n , E n ), 
and we use the same assumptions on the hash functions 
as Section [3] Let B„ be the uniform random on the set 
{b € £„ | F„(b) = S n }. As in Section[3] B„ and F„ are sta- 
tistically independent and we can apply the privacy am- 
plification theorem. Let Z" be Eve's received signal after 
encoding B„ by the given encoder e„ for BCD, applying 
the artificial noise P" X \ V , and transmitting the resulted sig- 
nal over the given channel. By using Theorem Q~3] we 
have 

I(F n (B n );Z n \F n ) < |L . (12) 

\& n xS„\Pp 

Recall that the function <j> is essentially Gallager's func- 
tion Eq [13], and we have 



exp^Oo,^,^,,^,,))) 
< max exp(0(p, P" zw , P n )) 

P„ on 'V" 1 

= max exp(#(p,P" (by H2). 

Pi on T 1 s 1 



(13) 



(**) 



Because (**) is concave with respect to P\ 1131 . its maxi- 
mization can be computed in practice, for example by [ 6 1 . 
On the other hand, min fl (**) is convex with respect to p, 
so its minimization with respect to p can also be computed 
by the bisection method (6l . 

We have to investigate under which conditions the 
above computational procedure for the secret message 
size can achieve a rate pair (Rq, R\). The logarithm of 
the right hand side of Eq. ( TT2l is 

p (log \S„\ - log \S„\ - log |£„| + ^ /|V U j - logp. 

Since <p is essentially Eq in [13 1, lim p ^o <P(s> Pz\v, Pv)lp = 
I(V;Z). Therefore, if log|5„| < log|S„| + log|£„| - 
n(maxp v I(V;Z) + 6) for all n, then I(S n ;Z"\F n ) goes to 
zero as n — > oo. This means that if (Rq, R[) is achievable 
as a rate pair in the BCD defined by Pyz\v by adjusting the 
artificial noise Px\v and R\ < Ro+R[ -maxp,, I(V; Z) then 
the rate pair (Rq, R\) is achievable by our computational 
procedure for an upper bound on the mutual information. 

When we use Theorem [T3l in place of Proposition [6] in 
Section|3] we can prove an achievable rate pair (Rq, R\) to 
be achievable by Theorem[T3]only if R is close to I(U; Z). 
We cannot prove the achievability of a rate pair (Rq, R\) 
by Theorem[l3]if Rq =* I(U; Y) < I(U; Z). 

Remark 14 As Remark\T2\ the generalization of results 
in Section^to the Gaussian channels is easy provided that 
the transmitted signal is chosen from a fixed finite subset 
of R for every channel use. When the transmitted signal 
is chosen from varying finite sets for each channel use, we 
have difficulty in Eq. M3\l . 

5 Conclusion 

We argued that the weak security criterion, which requires 
only the mutual information divided by the code length 
converges to zero, may be inappropriate in some appli- 
cations, by explicitly providing an insecure example, and 
made a case for the strong security criterion introduced by 
Maurer [21 1, which requires the mutual information con- 
verges to zero without division by the code length. The 
broadcast channel with confidential messages ifTTl is one 
of fundamental problems in the information theoretical 
security |19|, but its capacity region remained unknown 
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under the strong security criterion before this paper. We 
have shown that the capacity region under the strong se- 
curity is the same as that under the weak one. 

On the other hand, the separation between secrecy cod- 
ing and error correction coding is important from both 
theoretical and practical viewpoints. We presented a ran- 
dom coding argument and a code construction that sep- 
arate error correction and secrecy. However, our separa- 
tions for the broadcast channel with confidential messages 
are still incomplete compared to the source channel sep- 
aration |9, Section 7.13] or the separation in the classical 
lfT2l |23 1 and quantum [23| key agreement problem, be- 
cause we cannot separately and independently construct 
codes for secrecy and error correction and combine them 
without losing the optimality in the sense of asymptotic 
information rate, as done in [9 Section 7.13] and Ifl2ll23l . 
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